# Hub mode (the chart default): intake + registries + web UI, with
# artifacts in the release's embedded Garage store (chart default in
# hub mode, longhorn-backed). Builds happen on runners from the
# saggar-worker chart, to be paired against this hub once it is up.
image:
    repository: git.vhaudiquet.fr/saggar/saggar
    # Empty: follows the chart's appVersion — the commit SHA CI stamped
    # on the pushed images.
    tag: ""
# Private Gitea registry: the chart renders an imagePullSecret from
# these. Same access token as packages-auth-secret.yaml (the
# pre-commit sops hook encrypts this file).
imageCredentials:
    create: true
    registry: git.vhaudiquet.fr
    username: ENC[AES256_GCM,data:QijNVgCz8hF0Kg==,iv:eredumkfDLZ6AKM8nCcZwl14EyRRnBvXLL52Yaau0d0=,tag:P/miR7dyjGaMxqM/g7r0ow==,type:str]
    password: ENC[AES256_GCM,data:SY3i9j6rBFh5RfehxBQX+ljVe11cGL1cRNkiFqcNbBlNkF9uqMC9hQ==,iv:qpHKDwzQDr8uTJN9e7OgUr/JN2O+EGJylbH/R+EU9tc=,tag:2DbOvUUTsrNfhIzhjirz/Q==,type:str]
# Login via the home Gitea: the engine is the confidential client of
# the provider and runs every code exchange, so its discovery drives
# the endpoints (issuer verified live). Credentials live in
# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
# id in too), so nothing sensitive renders into the ConfigMap. The UI
# needs nothing: it discovers the provider from the engine's open
# /auth/methods.
auth:
    providers:
        - name: gitea
          issuer: https://git.vhaudiquet.fr
          existingSecret: ENC[AES256_GCM,data:lvGugwt7hGbPGF9JSn88B1c=,iv:1Zqze/jXv8kuVNdGdJB9PwvMFHWBihIsEX9jJo7DQvg=,tag:gSgFdyI7HfAj8dwoGd2kbg==,type:str]
          clientIdKey: client-id
          clientSecretKey: ENC[AES256_GCM,data:6vvWWtiomj1TpNJ41g==,iv:xb9HfW2MQNs9vLmPxujUV8us8Tce08L3si1Qd/CCwWk=,tag:LQdV0f79n9NqKBOrh6DDTg==,type:str]
ingress:
    enabled: true
    className: traefik
    # The engine host: CLI intake + the docker/apt registry front-ends.
    host: api.saggar.dev
    # The chart's default annotations are nginx-specific (SSE
    # buffering); traefik streams unbuffered by default, so clear them.
    annotations: {}
    # TLS terminates at Caddy with the cert-manager saggar.dev certs;
    # Caddy proxies to Traefik by host, so no tls block here (same as
    # pkgatlas's ingress).
    tls:
        enabled: false
ui:
    # Sign-in redirect base — the UI's own public origin.
    publicBaseUrl: https://saggar.dev
    # The engine's public origin for the docker pull / apt usage lines.
    # Set explicitly: the chart derives it from the hub ingress, whose
    # tls is off here (Caddy terminates) — that would render http://.
    apiPublicOrigin: https://api.saggar.dev
    ingress:
        enabled: true
        className: traefik
        # The UI lives on its own host: the engine mounts its API and
        # registry surfaces at root (/v2, /apt, /nodes), paths the UI
        # pages also use.
        host: saggar.dev
        annotations: {}
        tls:
            enabled: false
docs:
    # The chart deploys the book by default; the ingress renders as
    # soon as a host is set (no enabled knob).
    ingress:
        className: traefik
        host: docs.saggar.dev
        tls:
            enabled: false
sops:
    lastmodified: "2026-10-01T17:39:26Z"
    mac: ENC[AES256_GCM,data:1pn1rHaCx8eYYR6NPt6hgUEwDxRYQQtgkklSu6FroH92gUq2jhX3420lzboTMvvpuBF/vqjbuw1sIR60YfZZ8R5ahw7CCcv8L5sfz9DhUU/vMBYF6r3HDY70AnXkPK3+rPw6ZofB8h+Y/DQEBpPe/LeDEPCOGQjIml349yAvMIk=,iv:A6/PeL8JuFtzS0hMAiP2/dvbXq7Ob3o9VaA0pE2IWEU=,tag:GV2pspKqmaQjafkp4HUwSw==,type:str]
    pgp:
        - created_at: "2026-10-01T17:39:26Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiAQ/+PFcuCPKb5Mpej7uym38cwwVgjaJoaeLrKpfWBw4CEy3v
            PbJgTS7kNKyjHqoeHQcLZZwmms1//b7XQfX2kPnNJIo/06cAgYv5AJ4etMNJ3hys
            ShuiTMmMayKg2U8TdMhzwKFgymhQ5PUzGU1Xg2D9J1hUgW/rRVOb5wHKsBgYkOIx
            ufuQpPhNm9j1xOqWtnf6xCRbZ1HRlE6mAX+4TvRJk/x3U1YW1gI2neyEtFiuCsCj
            PSO9W+5WovDLQlCmGRmCweUwODShpdVqBEoXSS3wjGihz9xKH3lS+NnPZVMoeurE
            kzHjTxQgv4ZLDo9OuXcZz5mlXju9tmvkpLpqP1oHnN+es6Ks0jIpZcvXaZvvF4W5
            CLsC9dDplvAA3IpiF6+vpdDL0/QHpxo61V4jLLqO6o84x2jD1odR+zSkmxUxaQ94
            hxlPY+DGTrvHV0qOWlWLLZO6ddwOqeUC6ntBiZu3FG3UwTwPv9YXvi+ApP4Lylov
            BNKaCxKLalD37BKcPrpaJBwucME56Ny9p0WbHUaBNv74UGIKqPl6BI+9z7oObsrT
            YfmcB0Wlpz8N6SHntYJDhLJktJ27csy6BTPjQsFEK/dHbGyR5X4CiBSehqGd400s
            bomyLdR7m3g4fFG7Qq9Wzh8MA2WC6Fx+ExUXz91xrsejEJhckUl9N0sQDdCO3trS
            UQFWjDQEh9LAJ3U/nQ0SWjaNnJ25U0qJ9qMZYyDDR2aiMqRAwcOZc315S+S/FrGE
            lMkMngLiKqznm9GSsgcBgRIcqovbJr1gCJS/b2+4abjQtw==
            =gAn1
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
    mac_only_encrypted: true
    version: 3.10.2